Grimaldi - Risk Breakdown Matrix

download Grimaldi - Risk Breakdown Matrix

of 16

Transcript of Grimaldi - Risk Breakdown Matrix

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    1/16

    Art icle

    MANAGING PROJECT RISK SUSING A CROSS RISKBREAKDOWN MATRIX

    David Hil lson a, Sabrina Grimaldi b and CarloRafele baRisk Doctor Surgery, 3 Lower Hayshott, Petersfield, Hampshire, G031 4PZ, UKbFacolta Di Ingegneria, Politecnico di Torino, 10129 Torino, Corso Duca Degli

    Abruzzi 24, Italia

    Correspondence: Dr David Hillson, 3 Lower Heyshott, Petersfield, Hampshire GU31 4PZ, UK

    E-mail: [email protected]

    Abstract

    Projects are complex undertakings involving a unique set of tasks and activities con-

    ducted within a set of constraints to meet defined objectives. Risk in projects is also

    complex, arising from a wide range of sources and having a broad scope of possible

    effects on the project. Given these two dimensions of project complexity, t he manage-ment of the relationship between project work and project risk is a key success factor

    for every project. This paper develops a method for understanding and managing risk on

    a project, using a combination of the Work Breakdown Structure (WBS) and Risk Break-

    down Structure (RBS), resulting in the Risk Breakdown Matrix (RBM). An example is used

    to demonstrate how to measure risk concentration within the RBM using a risk score

    based on the scale or size of individual risks. I t is also possible to combine different lev-

    els of the WBS and RBS into a pyramidal structure where each of the layers is an RBM.Keywordsrisk management; risk analysis; Work Breakdown Structure; Risk BreakdownStructure; Risk Breakdown Matrix

    Risk Management(2006) 8, 6176.doi:10.1057/palgrave.rm.8250004

    Using the Risk Breakdown Structure

    Since it was first described (Hillson, 2002a, b, 2003), the RiskBreakdown Structure (RBS) has been recognized as a useful tool for

    structuring the risk process, and has been included in several risk

    Risk Management2006, 8, (6176) 2006 Palgrave Macmillan Ltd 14603799/06 $30.00

    www.palgrave-journals.com/rm

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    2/16

    Risk Management

    David Hillson et al

    62

    standards and guidelines (for example, Association for Project Management,2004; Project Management Institute, 2004). The RBS is defined in similarterms to the Work Breakdown Structure (WBS), as A source-oriented group-

    ing of project risks that organises and defines the total risk exposure of theproject. Each descending level represents an increasingly detailed definition ofsources of risk to the project ( Hillson, 2002a). The RBS is therefore a hierar-chical structure of potential risk sources, which can be an invaluable aid tounderstanding the risks faced by the project. It can act as a framework to struc-ture and guide the risk management process, in the same way that the WBS canstructure the project management process because it scopes and defines thework of the project (Project Management Institute, 2001).

    A generic RBS might seem to be useful, but it would be unlikely to include the

    full scope of possible risks to every project. An alternative is therefore to pro-duce a specific RBS structure relating either to a given industry or to the typesof project undertaken by a particular organization. Once the RBS has beendefined, it can be used in a variety of ways. Some of these facilitate the riskmanagement process on a particular project, while others are relevant acrossprojects. The main uses and benefits of the RBS are as follows (Hillson,2002a, b):

    Risk identification aid The higher levels of the RBS can be used as a promptlist to ensure complete coverage of risk identification, or lower levels can be

    used as a checklist. In addition the RBS can be used to structure lists of risksidentified by other methods. This enables gaps or blind spots in risk identifica-tion to be seen and addressed, and reveals any double-counting or duplication.Risk assessment Identified risks can be mapped into the RBS and catego-rized by source. This exposes the most significant sources of risk to theproject, and indicates areas of dependency or correlation between risks. Riskresponse development can then be focused on high-risk areas, with genericresponses for root causes or dependent groups of risks.Comparison of alternatives Risks associated with competing bids and ten-

    ders can be compared directly if the same RBS is used to structure theirassociated risks. This can also provide input to trade-off studies examiningalternative development options or investment decisions. Risk exposure ondifferent projects within a programme or portfolio can also be directlycompared since the RBS presents a common structure and terminology todescribe the risks. This can help in development of a risk-balanced portfolio.Risk reporting Different project stakeholders need different levels of re-porting, and the RBS can be used to roll-up risk information to a higherlevel for senior management, as well as drilling down into the detail required

    to report on project team actions. It also provides a consistent reportinglanguage for risk, reducing the potential for misunderstanding, especiallywhen used for cross-project reporting.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    3/16

    Risk Management

    Project Risk Management Using RBM

    63

    Lessons learned for future projects Risk elements of post-project reviewson completed projects can be captured using an RBS as a common frame-work. This can reveal common or generic risks, allowing development of

    preventative responses, and feed-forward of effective actions into futureprojects.

    Successful and effective risk management requires a clear understanding of therisks faced by the project and business. This involves more than simply listingidentified risks and prioritizing them by their probability of occurrence andimpact on objectives. The large amount of risk data produced during the riskprocess must be structured so that we can understand it and use it as a basisfor action. A hierarchical RBS framework similar to the WBS provides anumber of benefits, by decomposing potential sources of risk into layers ofincreasing detail. The RBS is a powerful aid to risk identification, assessmentand reporting, and the ability to roll-up or drill-down to the appropriate levelprovides new insights into overall risk exposure on the project. It also providesa common language and terminology to facilitate comparison of alternatives,cross-project reporting and lessons learned.

    Linking WBS and RBS

    The interconnection between the Work Breakdown Structure (WBS) of aproject and its RBS is a useful technique to associate risks to the activities of aproject (Aleshin, 2001).

    The WBS uses a hierarchical structure to define the major tasks, minor tasksand work packages (WPs) necessary to reach the final objectives of a project(Project Management Institute, 2001), while the RBS classifies project risksusing a hierarchical system of sources of risk (Hillson, 2002a, 2003). BothWBS and RBS commonly have three or four levels of increasing detail. Thereare evident analogies between WBS and RBS: WBS constitutes the basic frame-work for the management of a project; likewise, RBS can be used as a tool to

    structure the risk management process (Hillson, 2002b).The combined use of WBS and RBS can be used to generate a matrix struc-

    ture, which allows the project team to manage the risk at a level of detailappropriate to the specific business context.

    To produce such a combined framework, risk analysis is first performed iden-tifying and classifying risks using the RBS, either directly or to support othermethods of identification such as brainstorming or interviews. The lowestlevels of the RBS are then linked to the WPs in the WBS, producing a two-dimensional matrix. Obviously, a link is created only if a particular risk

    can affect a specific WP. A WBSRBS matrix is generated which we callthe Risk Breakdown Matrix (RBM) (Rafele et al., 2005), as illustrated inFigure 1.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    4/16

    Risk Management

    David Hillson et al

    64

    For every RBM cell containing risks, the value of each risk is calculated usingtwo components: the probability of occurrence (P) and the degree of impact(M). Probability is related to the presence of a risk in the RBS, and impact re-fers to the effect of that risk in the WBS. The calculation of the value of each

    risk can be determined in various ways, depending on the availability of data,as follows (Grimaldi and Rafele, 2002; Project Management Institute, 2004):

    using an ordinal scale approach, the degree of impact (M) and the indexof occurrence (P) are assessed using descriptive labels (Franceschini, 2001):for instance, very low, low, medium, high, and very high;using a cardinal scale approach, both the degree of impact and the indexof occurrence are divided into classes, distinguished with numerical valuesincluded in dimensionless preset scales (for example from 1 to 9) (Misani,1994);using a quantitative approach, in which the degree of impact is related tothe parameter directly influenced by the risk (e.g. time delay, increase ofcosts or other), whereas the probability of occurrence is usually described asa percentage (from 1 to 99%).

    Considering the risks for every WP, an evaluation of the level of criticality fora single WP can be obtained, either in absolute terms or relative to other WPs.The degree of criticality is determined by adding the risk values for each rowin the RBM matrix (Figure 1) (Grimaldi and Rafele, 2002). This can be

    expressed by the formula: n

    j=1i, j i, jWP, i

    MPR =

    RBS

    risk sources

    Values for WP

    Pi,1 Pi,2 Pi,3 Pi,n R WPs order

    WP1 I1,j

    I2,j

    I3,j

    I4,j

    I5,j

    R1, j

    WP2

    WP3

    WP4

    WBS

    Work

    packages

    WP5

    WPm Im,i

    R Ri,1Risksources

    evaluationP2,3 X I 3,2

    Risk sources

    order

    Figure 1 Risk Breakdown Matrix (RBM) with sample evaluation.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    5/16

    Risk Management

    Project Risk Management Using RBM

    65

    where RWP,i

    is the global incidence of risks in WP-i; Pi,j

    is the probability of

    occurrence of risk-j in WP-i; Mi,j

    is the impact of risk-j in WP-i.The column in Figure 1 titled WPs Order can be used to record a ranking

    of WPs, indicating which are most risky, determined by the total value of risksaffecting each WP.

    A similar reasoning can be applied to analysing risk sources by separatelyconsidering the columns of the RBM matrix. The sum of the values for eachcolumn identifies the relationship of all WPs of the project to a particularsource of risk or the presence of risks in different WPs (Figure 1). In this casethe formula is

    m

    i=1i, j i, jris, i

    MPR =

    where Rris,j is the total effect of risk source risk-j in the whole project.The value obtained by summing columns using the second formula allows aclassification of sources of risk in terms of their influence on the project.

    The phase of risk evaluation is followed by the phases of monitoring andcontrol, in which appropriate interventions are defined on the basis of the clas-sification. The following alternatives should be considered:

    1. Intervention aimed at the single most significant risk, as determined fromthe RBM, after having assigned the values ofP

    i,jand M

    i,j. Attention should

    be focused on the risk with the highest value of Ri,j

    and continue in

    decreasing order to the lowest acceptable limit;2. Evaluation of all the risks related to the element of the project identified as

    most critical (i.e. maximum value of RWP,i

    ), on the basis of adding the

    values for each row in the RBM (Figure 1). Risk responses should focus onexecution of the WP or on the type of resources applied to that element ofthe project;

    3. Evaluation of the influence of the single most significant source of risk ondifferent WPs, considering the totals of RBM columns, based on a calcula-tion ofR

    ris,j(Figure 1). The response will address ways to reduce the risk

    source, decreasing its manifestation in the project.

    The choice among the three options must be made with a special regard to theposition of the risks in the RBM matrix and on the basis of the value in each

    cell. For instance, if risks are concentrated in specific WPs (the highest valuesoccur on the rows related to the WPs), option 2 above is better, whereas if asingle value is much higher than the others, it is useful to focus on the most

    critical risk (option 1).Use of the RBM to analyse risk can be demonstrated using an example

    based on a software development project. The analysis starts with definitionof WBS and RBS structures. For this example, both WBS and RBS havethree levels. The first level of the WBS (Figure 2) divides the activities of the

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    6/16

    Risk Management

    David Hillson et al

    66

    project into Project Management, Product Requirements, Detail SoftwareDesign, System Construction, and Integration & Test. Similarly, the firstlevel of the RBS divides the sources of risk into Product engineering, Deve-lopment environment, and Program constraints (Figure 3). The RBM

    analysis method proceeds with relating risks in the lowest level of theRBS to the work-packages of the project in the corresponding lowest

    level of the WBS. (For simplicity in this example we only show the Program

    LEVEL 0 LEVEL 1 LEVEL 2 LEVEL 3

    Develop Project CharterDefine Scope

    Develop Resource PlanDevelop Communication Plan

    Develop Risk PlanDevelop Change Control Plan

    Develop Quality PlanDevelop Purchase Plan

    Develop Cost PlanDevelop Organization Plan

    Planning

    Develop Project ScheduleConduct Kickoff Meeting

    Weekly Status MeetingMonthly Tactical Meeting

    Meetings

    Project Closing Meeting

    Standards

    Project Management

    Administration Program OfficeCreate Draft Software RequirementsReview Draft Software RequirementsUpdate Draft Software Requirements

    Review Final Software Requirements

    Software Requirements

    Software Requirements ApprovedCreate Draft User DocumentationReview Draft User DocumentationUpdate Draft User Documentation

    Review Final User Documentation

    User Documentation

    User Documentation ApprovedCreate Initial Training Requirements

    Review & Approve Training RequirementsCreate Initial Training Materials

    Review & Approve Training MaterialsConduct Trial Course Delivery

    Training Program Materials

    Updateand Finalize Training MaterialsCreate Draft Hardware RequirementsReview Draft Hardware Requirements

    Product Requirements

    Hardware

    Hardware Requirements ApprovedCreate Initial Software DesignReview Initial Software Design

    Update Initial Software DesignReview Final Software DesignDetail SoftwareDesign

    Software Design Approved

    Configure SoftwareCustomize User Documentation

    Customize Training Program MaterialsInstall Hardware

    System Construction

    Implementation & Future SupportSoftware

    System Test Plan

    System Test CasesSystem Test Results

    System Test PlanSystem Test Cases

    System Test ResultsUser Documentation

    Training program Materials

    Hardware

    Softwareimplementation

    project WBS

    Integration &Test

    Implementation & Future Support

    Figure 2 WBS for software development.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    7/16

    Risk Management

    Project Risk Management Using RBM

    67

    constraints branch of the RBS and the Project Management branch ofthe WBS.)

    This produces a matrix (Figure 4), which allows classification of the risks,in this example using a cardinal scale. Based on the numerical values in thematrix, various conclusions can be drawn, including:

    identifying which activities have more associated risks (in the example this isthe activity Develop Project Charter);

    LEVEL 0 LEVEL 1 LEVEL 2 LEVEL 3

    Stability

    CompletenessRequirements

    Feasibility

    Functionality

    InterfacesDesign

    Testability

    Feasibility

    TestingCode& unit test

    Coding/Implementation

    Environment

    ProductIntegration test

    System

    Maintainability

    Reliability

    Product engineering

    Engineering specialities

    Security

    Formality

    Process controlDevelopment process

    Product control

    Capacity

    ReliabilityDevelopment system

    System support

    Planning

    Project organisationManagement process

    Management experience

    Monitoring

    Project organisationManagement methods

    Management experience

    Cooperation

    Communication

    Development environment

    Work environment

    Morale

    Staff

    BudgetResources

    Facilities

    Type of contractContract

    Restrictions, dependencies

    Customer

    Project risk

    Program constraints

    Program interfaces

    Subcontractors

    Figure 3 RBS for software development.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    8/16

    Risk Management

    David Hillson et al

    68

    Figure4

    MatrixRBMf

    orasoftwaredevelopmentwithacardinalscaleapproach.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    9/16

    Risk Management

    Project Risk Management Using RBM

    69

    identifying the most important single source of risk, that is, with the highestvalue ofR

    WP,j(in the example this is Staff)

    to single out the most significant relationship (in the example the link

    between Restrictions and Develop Project Charter is highlighted).

    Such considerations will allow risk responses and actions to be planned,increasing the effectiveness of the interventions.

    The matrix can be linked to the elements of a risk register, in which it ispossible to insert for each cell a description of the risk, and the reduction andmitigation plans derived by considerations of the numeric values (Patterson

    and Neailey, 2002).

    Using an WBS/RBS/RBM pyramid for layered r isk analysis

    Optimal analysis of risk identifies risks with a sufficient degree of detail to beable to determine the most vulnerable points in a project. Therefore, it is neces-

    sary not only to classify individual risks, but also to quantify their relationshipwith areas of the project, in order to understand the correct priority of inter-vention among the possible mitigation actions.

    As a result, it is useful to analyse risk in a hierarchical manner at differentlevels within the project. This can be achieved by developing a pyramidal struc-

    ture, linking the hierarchical levels of WBS and RBS into RBMs with increas-ing degrees of detail.

    The WBS and RBS hierarchies can be visualized as two triangles, whosedimensions depend on the number of levels and the degree of detail in eachlevel.

    If the WBS and RBS have the same number of levels, it is possible to join thetwo triangles to form the faces of a pyramid, where the detailed RBM matrixbetween lowest levels of RBS and WBS constitutes the base. At each levelanother RBM is created, whose area depends on its position within the

    two triangles, that is, depending on the degree of detail of the WBS and RBS

    (Figure 5).It follows that the number of layers in the pyramid will match the levels of

    detail in the WBS and RBS, and each layer represents an RBM matrix at a dif-ferent level of detail.

    The highest RBM matrix is defined by the intersection of the first levels of theWBS and RBS. This identifies the macro areas of risks in a project, because itcrosses the main tasks or aggregated deliverables with generic types of risk.This first level of generic analysis therefore only allows identification of areasof risk within the main sectors of the project.

    The next level of the WBS defines the main deliverables of the project (Villa,2003) and if they are crossed with the second level of RBS, the possible vulner-ability and criticality of each deliverable is exposed. At this level, an ordinal

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    10/16

    Risk Management

    David Hillson et al

    70

    scale could be used, with descriptive categories of impact and probability ofoccurrence.

    If the detail of WBS and RBS is increased further, a more precise analysis of

    the risk can be undertaken, using the cardinal scale approach, or if the eco-nomic or time impacts are known, a quantitative analysis becomes possible.

    In the construction of the pyramid, with a top-down approach from the ver-

    tex to the base, risks are defined and quantified at an increasing level of detailrelated to the elements of the project affected.

    This is the most important phase of the risk evaluation, in which it is neces-sary to put the greatest energies in terms of knowledge, competence and ability

    of all the project resources with the purpose to get the best quantification ofthe risk. In this way, it is possible to understand which risks have the biggest

    impact, and also to establish where it is necessary to intervene and which arethe priorities.

    After the most detailed quantification of all the risks for every activity of theproject, compiling the RBM matrix at the base of the pyramid, it is also useful

    to conduct a bottom-up assessment, going up the pyramid from a specific levelof evaluation to a more general one. For instance, passing from a larger RBMmatrix to a smaller, it is possible to aggregate the risks affecting particularareas of the project.

    The pyramid representation clearly visualizes the hierarchical nature of the

    RBM matrixes. It also allows identification of the links that connect data ondifferent levels, which can be used to structure management of risk informa-tion at different levels of RBM matrixes.

    LEVELn

    LEVEL

    1

    1

    m

    WBS-RBS

    LEVEL2

    LEVEL3

    2

    matrix

    WBS-RBS

    3

    matrix

    WBS-

    RBS

    n matrix

    WBS-

    RBS

    WBS

    R

    B

    Sn

    1

    matrix

    WBS

    R

    B

    S

    Figure 5 Risk pyramid.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    11/16

    Risk Management

    Project Risk Management Using RBM

    71

    As we have developed the model thus far, the WBS and RBS have been usedproperly vis--vis driving the activities/deliverables to the lowest levels of thestructure. At this level, an appropriate and detailed risk analysis and assess-

    ment could be made. However, by stratifying the pyramid according to thedifferent levels of the matrices, practical analysis of the risks is diluted andthe RBM is meaningful mostly at the lowest level of the two structures (WBSand RBS).

    Nevertheless, useful information could be found also at the highest levels, infact aggregate data could be compared across multiple projects. Range of risksfor areas show the evolution of risk behaviour through the time for successive

    projects.This approach can be used not only as a mean of risk analysis, but also as a

    way of facilitating communication between the different stakeholders in aproject. For instance, project managers who understand the specific issues ontheir project can introduce detailed data on the risks in the lowest layers of thepyramid to form the base RBM, and at the same time top management canthen obtain summary information on risk exposure from the higher-level RBM

    matrixes allowing them to make appropriate strategic decisions, as it happensfor milestones representation in project schedule.

    This pyramidal RBM approach can also support different levels of risk proc-

    ess dependent on the level of risk maturity of the organization (Hillson, 1997;Hopkinson, 2000; Hulett, 2001; McKenna, 2001). For example, it is likely

    that organizations with low-risk management capability and maturity mightbe able to complete only the first levels of the pyramid, whereas organizationswith higher risk management maturity might be able to complete the whole

    pyramidal structure.

    Example of WBS/RBS/RBM pyramid for softwaredevelopment

    Going back to the software development example, we can complete the risk

    analysis using the pyramidal structure of the risk. At the highest level of WBSand RBS, it is possible to define the smallest matrix, which distinguishes 15main areas of risk affecting the project (Figure 6a). Each of these areas must beexpanded, to obtain a precise quantification of the risk. In this way, largerRBM matrixes would be produced.

    A full analysis of the software development example at all RBM levels is be-yond the scope of this paper: our analysis therefore expands only the single

    RBS branch ofProgram constraints in the WBS area ofProject Management.This uses the second levels of the WBS and RBS: for the WBS area ofProject

    Management, three subareas can be decomposed: Planning, Meetings, andAdministration. For the RBS area Program constraints the defined groupsare Resources, Contract, and Program interfaces. Their combination produces

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    12/16

    Risk Management

    David Hillson et al

    72

    R

    R=568

    FromRBS

    -

    -

    -

    -

    -

    -

    -

    -

    -

    -

    -

    From

    WBS

    -

    -

    -

    FromRBS

    (Program

    constraints)

    Resources

    Con

    tract

    Program

    interfaces

    Planning

    R=199

    R=109

    R=51

    Meetings

    R=35

    R=6

    R=6

    Fr

    om

    W

    BS

    (Project

    Ma

    nage

    m

    ent)

    Administration

    R=48

    R=

    15

    R=99

    WBS

    RBS

    WBS

    RBS

    WBS

    RBS

    WBS

    RB

    S

    WB S

    RB S

    a

    b

    LEVEL

    1

    LEVEL

    2

    LEVEL

    3

    LEVEL

    n

    LEVEL

    1

    LEVEL

    2

    LEVEL

    3

    LEVEL

    n

    1

    m

    atrix

    WBS-

    RBS W

    BS-

    RBS

    WBS-

    RBS W

    BS-

    RBS

    2

    matrix

    3

    matrix

    n

    matrix

    1

    matrix

    WBS-

    RBS W

    BS-

    RBS

    WBS-

    RBS W

    BS-

    RBS

    2

    matrix

    3

    matrix

    n

    matrix

    Figure6

    First(a)andsecond(b)matrixR

    BM.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    13/16

    Risk Management

    Project Risk Management Using RBM

    73

    a 33 matrix (Figure 6b), in which it is possible to associate more specificsources of risk to every single deliverable of the project. In this phase, the de-gree of detail of the matrix optimizes identification of the risks within Project

    Management. Nevertheless, to allow analysis using an ordinal scale or a cardi-nal scale, it is necessary to expand again the matrix of Figure 7a, using thethird levels of the WBS and RBS. With a cardinal scale approach, a 717 ma-trix is produced (Figure 7b), which attributes a value to each risk based on its

    impact and occurrence. Our analysis stops at the third level of WBS and RBS:with the third matrix of dimension 3836, which constitutes the base of thepyramid. For brevity, we have stopped the development of the pyramid levels

    in the example; of course, the analysis could go more in detail right down toindividual risk statements.

    Going up the pyramid, it is possible to quantify risk for every area of theproject, summing the numerical values of the single risks at the lowest level ofthe pyramid. Repeating this procedure to the highest matrix, we could calcu-late a total value of 568, which represents the total degree of risk arising fromRBS source Program constraints that could affect the WBS area of ProjectManagement. Repeating this calculation a further 14 times (there are 15 cellsin the first matrix RBM), the evaluation of risks in the whole project can becompleted, both for individual project areas and for all areas together. In this

    way, top management has all the information required to decide the rightactions to respond to future risks, focusing resources on the most vulnerable

    areas of the project.

    Conclusions

    Two of the main areas of complexity in projects arise from the work to be doneand the risks that could affect achievement of objectives. Hierarchical frame-works have been developed to provide structure in these two areas: the WBS

    for project tasks and activities, and the RBS for sources of risk. Both WBS andRBS are powerful tools for understanding and managing the scope and risk of

    the project, respectively.There is, however, a further level at which these two tools can be used to as-

    sist the project manager in addressing project complexity as it affects bothscope and risk. Combining WBS and RBS to form the RBM allows identifiedrisks to be linked with affected areas of the project. This paper has shown how

    to generate a base-level RBM from the lowest level of the WBS (Work Pack-ages, WPs) and the lowest level of the RBS (individual risks), revealing themost significant risks and those WPs in the project most exposed to risk.

    Further development of the RBM concept allows different levels of WBS and

    RBS to be linked, producing a pyramid of hierarchical RBMs, each at a higherlevel of detail. At the top level, the RBM relates key sources of risk to the majordeliverables and tasks of the project, allowing senior management to make strate-

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    14/16

    Risk Management

    David Hillson et al

    74

    22

    DaRBS

    (Programconstraints)

    Resources

    Co

    ntract

    Program

    Interfaces

    Planning

    R=199

    R

    =109

    R=51

    Meetings

    R=35

    R=6

    R=6

    DaWBS

    (da

    Project

    Manage

    ment)

    Administration

    R=48

    R

    =15

    R=99

    a

    b

    LEVEL

    1

    LEVEL

    2

    LEVEL

    3

    LEVEL

    n

    1

    matrix

    2

    matrix

    3

    matrix

    n

    matrix

    WBS-R

    BS

    WBS-R

    BS

    WBS-R

    BS

    WBS-R

    BS

    Figure7

    Second(a)andthird(b)matrixRBM.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    15/16

    Risk Management

    Project Risk Management Using RBM

    75

    gic decisions. Analysis can also be performed up and across the pyramid, provid-

    ing useful information on patterns of risk exposure. Finally the pyramid providesa consistent framework for project risk reporting at all levels in the project.

    The RBM is a significant development of the tools available to assist theproject manager in addressing project risk, providing unique insights into theeffect of risk on different aspects of the project.

    About the Authors

    Dr David Hillson is an international risk management consultant and Director

    of Risk Doctor & Partners. Dr Hillson holds the PMP certification from theProject Management Institute (PMI), and is a Fellow of both the UK Associa-

    tion for Project Management (FAPM) and the UK Institute of Risk Manage-ment (FIRM). He is an award-winning conference speaker and author on risk

    management, and received the 2002 PMI Distinguished Contribution Award-for his work in developing the discipline. He is responsible for several signifi-cant innovations in risk management, which have been widely adopted.

    Sabrina Grimaldi received her MSc in Electronic Engineering in 1991 fromthe Politecnico of Turin. She also obtained a Master in Safety and risk analy-sis. Since 2000, she has been a Lecturer at the Politecnico of Turin. She haspublished many articles on risk management.

    Carlo Rafele received his MSc in Mechanical Engineering in 1984 from the

    Politecnico of Turin. Since then he has acquired considerable practical workexperience in many industries, working as project manager in engineering and

    construction companies. He later joined the Department of ProductionSystems and Business Economics at the Politecnico of Turin as an AssistantProfessor, and now teaches Project Management and Industrial Plants as

    Associate Professor. He has published several articles on project management

    and logistics.

    References

    Aleshin, A. (2001). Risk Management of International Projects in Russia. InternationalJournal of Project Management19, pp. 207222.

    Association for Project Management (2004). Project Risk Analysis & Management(PRAM) Guide 2nd edn. High Wycombe, Bucks, UK: APM Publishing. ISBN1-903494-12-5.

    Franceschini, F. (2001). Dai prodotti ai Servizi. Torino: UTET.Grimaldi, S. and Rafele, C. (2002). Analisi Dei Rischi Nelle Attivit Di Progetto. Impian-

    tistica Italiana 6, pp. 6978.Hillson, D.A. (1997). Towards a Risk Maturity Model. International Journal Project &

    Business Risk Management1 (1), pp. 3545.

    Hillson, D.A. (2002a). The Risk Breakdown Structure (RBS) as an Aid to Effective RiskManagement. Proceedings of the 5th European Project Management Conference (PMIEurope 2002), presented in Cannes France, 1920 June.

  • 7/29/2019 Grimaldi - Risk Breakdown Matrix

    16/16

    Risk Management

    David Hillson et al

    76

    Hillson, D.A. (2002b). Using the Risk Breakdown Structure (RBS) to understand risks.Proceedings of the 33rd Annual Project Management Institute Seminars & Sympo-sium (PMI 2002), presented in San Antonio USA, 78 October, 2002.

    Hillson, D.A. (2003). Using a Risk Breakdown Structure in project management.Journal

    of Facilities Management2 (1), pp. 8597.Hopkinson, M. (2000). Using Risk Maturity Models. Kluwers Risk Management

    Briefing40, pp. 48.Hulett, D.T. (2001). Key characteristics of a mature project risk organisation. Proceed-

    ings of the 32nd Annual Project Management Institute Seminars & Symposium,Nashville, USA.

    McKenna, S. (2001). Organisational Complexity and Perceptions of Risk. Risk Manage-ment: An International Journal3 (2), pp. 5364.

    Misani, N. (1994). Introduzione al risk management. Milano: Egea.Patterson, F. and Neailey, K. (2002). A Risk Register Database System to Aid the Manage-

    ment of Project Risk. International Journal of Project Management20, pp. 365374.

    Project Management Institute (2001). Practice Standard for Work BreakdownStructures. Project Management Institute:Philadelphia, USA.

    Project Management Institute (2004). A Guide to the Project Management Body ofKnowledge (PMBoK), Third edn, Project Management Institute: Philadelphia, USA.

    Rafele, C., Hillson, D.A. and Grimaldi, S. (2005). Understanding Project Risk Exposureusing the Two-Dimensional Risk Breakdown Matrix. Proceedings of the PMI GlobalCongress 2005 EMEA, Edinburgh, Scotland, 2325 May.

    Villa, T. (2003). WBS: istruzioni per luso, Manuale PMLAB-Tecniche dipianificazione-

    progetti.